HackBlue

Labs / Network defense

TLS certificate chain reader

Read five certificate chains the way a client does: hostname, dates, issuer links, and trust. Find the expired leaf, the missing intermediate, and the bad wildcard.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

Five internal hosts answered a TLS handshake. For each one, read the certificates the server sent and run the checks a client makes: does the name match, are the dates valid, does each issuer link to the next certificate, and does the chain end at a trusted root?

The lab clock is 2026-03-14T09:00:00Z, and the client trusts one root: CN=HackBlue Lab Root R1, O=HackBlue Lab Trust.

Host

View

Chain sent by www.contoso.example2 certificates
  1. depth 0
    Subject
    CN=www.contoso.example
    Issuer
    CN=HackBlue Lab Issuing CA 2, O=HackBlue Lab Trust
    SAN
    www.contoso.example, contoso.example
    Valid
    2026-01-10 to 2026-04-10
  2. depth 1
    Subject
    CN=HackBlue Lab Issuing CA 2, O=HackBlue Lab Trust
    Issuer
    CN=HackBlue Lab Root R1, O=HackBlue Lab Trust
    Valid
    2024-06-01 to 2029-06-01

Client checks

  • pass
    Name matches the hostwww.contoso.example vs www.contoso.example, contoso.example
  • pass
    Every certificate is within its validity dateschecked at 2026-03-14T09:00:00Z
  • pass
    Each issuer matches the next subject2 certificate(s) sent
  • pass
    Chain ends at a trusted rootissued by HackBlue Lab Root R1, in the trust store

Verified. The client completes the handshake.

Steps

  1. 01Which host presents a chain that passes every check?

  2. 02On what date (YYYY-MM-DD) did the api.contoso.example certificate expire?

  3. 03shop.contoso.example fails with "unable to get local issuer certificate". What is wrong?

  4. 04Why does *.contoso.example not cover eu.api.contoso.example?

  5. 05What is the right fix for the self-signed intranet certificate?